Your best bet would be to use a routing firewall that performs 1:1 NAT to the server. 1:1 NAT means no translation tables, port forwarding, or any of the headaches of normal NAT. The firewall would have two NICs, one facing internet-side and the other on a VLAN with only the server.
[ internet...